Executive committees consistently ask one version of the same question: which AI tool should we standardise on? The question is reasonable. It is also wrong. It treats generative AI as a productivity-software category, like email or word processing, where vendor lock-in is the trade-off you make for simplicity. Generative AI is closer to professional services: different providers do different work, and pretending otherwise costs more than it saves.
The frontier-model market in 2026 has settled into a recognisable shape. Four major commercial families — Anthropic's Claude, OpenAI's ChatGPT and GPT API, Microsoft's Copilot, Google's Gemini — and a maturing open-source tier — Llama, Mistral, and the deployment platforms that wrap them. Each one is genuinely best-in-class at a different thing.
Decision matrix by use case
The crude framing — "which is best?" — produces vendor-marketing answers. The useful framing — "best for what?" — produces a portfolio.
| Use case shape | Default reach |
|---|---|
| Long-context reasoning, regulated work, document-heavy analysis, work where being wrong is expensive | Claude |
| Brainstorming, creative iteration, broad API ecosystem, image generation, voice agents | ChatGPT / GPT API |
| Microsoft-native workflows — Outlook, Teams, Excel, SharePoint, Word | Copilot |
| Google-native workflows — Workspace, Docs, Sheets, Gmail | Gemini |
| On-premise deployment, data-residency constraints, custom fine-tuning, large-scale inference cost optimisation | Open-source (Llama, Mistral) |
These are defaults, not laws. Each one shifts every six to nine months as model capabilities advance. The point of the framing is not to be right forever; it is to procure deliberately, and to put pilots on the tool best suited to the task instead of the tool the procurement team has already signed.
A procurement framework — five criteria
Beyond the use-case fit, the commercial and operational criteria matter more than the model leaderboards. We use a five-criterion framework on every selection:
- Data residency and processing location. Where does the data go, and through which jurisdiction? For regulated firms — banks, insurers, healthcare providers, public sector — this is the first filter, not the last. EU residency, UK residency, and US-only processing are now distinct commercial products at most providers. Make the requirement explicit before evaluating models.
- Audit trail and logging. Can you produce, on demand, a record of who used the system, what they asked, what it answered, and what data it had access to? For high-risk systems under the EU AI Act this is mandatory. For internal investigations, dispute resolution, and IP protection it is just basic hygiene. The differences between providers here are larger than the differences between models.
- Model versioning and deprecation policy. When does a model get replaced? How much notice do you get? Can you pin a version for a regulated workflow? The mid-2025 wave of model deprecations caught a lot of enterprises with production systems running on models that were sunset with weeks of notice. Make versioning a contractual term, not a vendor promise.
- Licensing model and unit economics. Per-seat licensing is simple but punishes high-usage teams. Per-token pricing is fair but unpredictable. Hybrid models — capped per-seat with token overage — are usually the right answer for enterprise but rarely the default offer. Model the actual usage shape of three real use cases before signing.
- Trust and safety controls. PII redaction, prompt-injection resilience, jailbreak resistance, content filters, system-prompt protection. Not glamorous; not optional. Two providers can have very similar model performance and very different safety postures. Test the controls on your data, not the vendor's demo data.
The single-vendor trap
The largest mistake we see is the enterprise-wide single-vendor mandate. It feels like simplification. It is, in practice, a commitment to using the best tool for one thing and a mediocre tool for everything else. It also creates concentration risk in one provider's pricing, capability roadmap, and outage history.
Most enterprises we work with end up with two to four tools in production: a primary horizontal partner (typically Claude or ChatGPT), a productivity-suite tool (Copilot or Gemini, driven by the existing M365 or Workspace footprint), and one or two specialist tools for niche use cases. The architecture decision worth making is not which vendor; it is the gateway layer that lets you route different use cases to different models without rebuilding the application each time.
The enterprises that move fastest do not pick a model. They pick an architecture that lets the model be a swappable component.
For the executive sponsor
Before approving the next enterprise licence, require a one-page note from the proposed sponsor that names: the three highest-value use cases, the model best suited to each, and the gateway or routing approach that makes the choice reversible in twelve months. If those three things are not specified, you are not choosing a tool. You are signing a contract.